From 8c0e8181791a93a28350e6cc454b591870cdbbec Mon Sep 17 00:00:00 2001 From: Seth Forshee Date: Wed, 7 Oct 2015 14:49:47 -0500 Subject: [PATCH] UBUNTU: SAUCE: (namespace) block_dev: Check permissions towards block device inode when mounting Unprivileged users should not be able to mount block devices when they lack sufficient privileges towards the block device inode. Update blkdev_get_by_path() to validate that the user has the required access to the inode at the specified path. The check will be skipped for CAP_SYS_ADMIN, so privileged mounts will continue working as before. Acked-by: Serge Hallyn Signed-off-by: Seth Forshee --- fs/block_dev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/block_dev.c b/fs/block_dev.c index 6c00227303d9..3a639adc02b2 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1742,9 +1742,14 @@ struct block_device *blkdev_get_by_path(const char *path, fmode_t mode, void *holder) { struct block_device *bdev; + int perm = 0; int err; - bdev = lookup_bdev(path, 0); + if (mode & FMODE_READ) + perm |= MAY_READ; + if (mode & FMODE_WRITE) + perm |= MAY_WRITE; + bdev = lookup_bdev(path, perm); if (IS_ERR(bdev)) return bdev; -- 2.39.2